CVE-2026-76287: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.4 and <10.4.4, a flaw in the Data Management REST API allows users with the preview_data_management_pipeline or edit_data_management_pipeline_job capabilities to read or delete preview jobs and results outside their ownership scope. The API verifies the user's capability but fails to confirm that the requested preview job belongs to the user, leading to unauthorized data access or deletion. This vulnerability is only exploitable when the Edge Processor feature is enabled, which is disabled by default.

An attacker with the specified roles can read or delete Data Management SPL2 preview jobs and results belonging to other users, potentially leading to unauthorized data exposure or loss. The impact is limited to the Data Management preview jobs and requires the Edge Processor feature to be enabled.

Upgrade Splunk Enterprise to version 10.4.4 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure that the Edge Processor feature remains disabled (default setting) to prevent exposure. Review and restrict user roles to limit assignment of preview_data_management_pipeline or edit_data_management_pipeline_job capabilities only to trusted users.